diff --git a/blockip/bip b/blockip/bip index 718b118..1481f1b 100644 Binary files a/blockip/bip and b/blockip/bip differ diff --git a/blockip/bip-static b/blockip/bip-static index 230becb..f71aee7 100644 Binary files a/blockip/bip-static and b/blockip/bip-static differ diff --git a/blockip/src/nftables.c b/blockip/src/nftables.c index 24eb006..eb7d1f2 100644 --- a/blockip/src/nftables.c +++ b/blockip/src/nftables.c @@ -130,11 +130,23 @@ int init_nftables_rules(void) { /* 删除旧的限速规则(如果存在) */ snprintf(command, sizeof(command), - "nft -a list chain %s input 2>/dev/null | grep -E 'ssh-ratelimit.*tcp dport' | awk '{print $NF}' | " + "nft -a list chain %s input 2>/dev/null | grep -E 'tcp dport.*ssh-ratelimit' | awk '{print $NF}' | " "xargs -r -I {} nft delete rule %s input handle {}", NFT_TABLE, NFT_TABLE); system(command); + /* 重建动态集合以清空旧的限速记录 */ + snprintf(command, sizeof(command), + "nft delete set %s ssh-ratelimit 2>/dev/null; " + "nft add set %s ssh-ratelimit '{ type ipv4_addr; size 65535; flags dynamic,timeout; }'", + NFT_TABLE, NFT_TABLE); + system(command); + snprintf(command, sizeof(command), + "nft delete set %s ssh-ratelimit_v6 2>/dev/null; " + "nft add set %s ssh-ratelimit_v6 '{ type ipv6_addr; size 65535; flags dynamic,timeout; }'", + NFT_TABLE, NFT_TABLE); + system(command); + /* 添加新的限速规则:超速IP加入临时封禁集合 */ snprintf(command, sizeof(command), "nft add rule %s input tcp dport %d ct state new "